EnCE Registry Analysis 5 — Questions and Answers
Question 1: Which forensic technique can recover deleted registry keys from a Windows system where the keys are no longer present in the live hive?
- Parsing Volume Shadow Copies for earlier versions of the hive file (Correct answer)
- Reviewing Windows Event Logs for registry modification events
- Searching browser cache files for previously exported .REG files
- Analyzing prefetch files for registry access patterns
Correct answer: Parsing Volume Shadow Copies for earlier versions of the hive file
Volume Shadow Copies retain point-in-time snapshots of registry hive files, allowing recovery of keys that were deleted before the snapshot was taken.
Question 2: What does it forensically imply when a registry key's LastWrite timestamp predates the system's recorded Windows installation date?
- The key is a protected system key that is exempt from the installation date rule
- The timestamp may reflect anti-forensic timestomping, an incorrect system clock, or a registry import from another machine (Correct answer)
- The key was automatically seeded by Windows Setup before the final install date was recorded
- The discrepancy is a known EnCase parsing artifact and can be safely ignored
Correct answer: The timestamp may reflect anti-forensic timestomping, an incorrect system clock, or a registry import from another machine
A LastWrite time before the OS installation date is anomalous and may indicate timestomping, clock skew, or imported registry data — all requiring corroborating evidence.
Question 3: In EnCase, which capability is most effective for automating registry artifact extraction across a large collection of forensic images?
- Keyword search using GREP patterns against raw disk data
- EnScript programs using the Registry class to programmatically traverse hive structures (Correct answer)
- The built-in Registry Viewer's batch export function
- The Case Processor's default Registry Analysis module
Correct answer: EnScript programs using the Registry class to programmatically traverse hive structures
EnScript's Registry class provides a programmatic API to open, enumerate, and extract specific keys and values from hives, enabling scalable automation across many images.
Question 4: What forensic evidence does the HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU key provide?
- Recently accessed files launched from the Windows taskbar jump list
- Commands typed into the Windows Run dialog box (Win+R) (Correct answer)
- Recently installed application executable names
- Programs executed via the Windows command-line interpreter
Correct answer: Commands typed into the Windows Run dialog box (Win+R)
RunMRU records the most recently used commands entered into the Windows Run dialog, revealing programs or paths the user manually executed.
Question 5: Which registry key records the last folder path accessed via a Windows common Open/Save file dialog?
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU (Correct answer)
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileDialog\MRU
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\ComDlg
- HKLM\SOFTWARE\Microsoft\Windows\Shell\OpenSaveMRU
Correct answer: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU
ComDlg32's LastVisitedPidlMRU and OpenSavePidlMRU in HKCU record which applications used file dialogs and which folder paths were last visited, revealing file access behavior.
Question 6: An examiner finds a USB device entry in HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR but no corresponding Windows Event Log entry. What should the examiner conclude?
- The device was never actually used; registry entries can be created without physical connection
- USB event logging may have been disabled or cleared, but the registry records device enumeration independently (Correct answer)
- The USBSTOR registry entry must have been planted by an attacker and is unreliable
- Only USB devices connected in the current Windows session populate USBSTOR
Correct answer: USB event logging may have been disabled or cleared, but the registry records device enumeration independently
USBSTOR entries are written by the Plug and Play subsystem independently of event logging; cleared or disabled logs do not invalidate the registry-based device evidence.
Question 7: When correlating USB device USBSTOR registry evidence with a specific user, which additional registry key links the device mount to a particular user account?
- HKLM\SYSTEM\CurrentControlSet\Enum\USB\[VID_PID]\[Serial]\Device Parameters
- HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 (Correct answer)
- HKLM\SYSTEM\CurrentControlSet\Control\DeviceClasses\[GUID]
Correct answer: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
MountPoints2 is written to the logged-in user's HKCU hive when a removable device is mounted, directly linking that user account to the device connection event.
EnCE Registry Analysis 5
Which forensic technique can recover deleted registry keys from a Windows system where the keys are no longer present in the live hive?